WIN-002 · Script

Windows Update Manager

Reports or installs pending Windows updates using the built-in Windows Update Agent.

What it does

Uses the Windows Update Agent COM interface that ships with Windows, so no third-party modules are needed. Report mode (default) lists missing updates. Install mode downloads and installs them silently. It never reboots on its own; it reports whether a reboot is required so your RMM can schedule one.

Requirements

Windows PowerShell 5.1+, run locally as SYSTEM or local admin (the Update Agent does not allow installs over remote PowerShell)

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = up to date / installed with no reboot needed
• 1 = updates missing, failed, or reboot required
• 2 = script error

Testing steps

1. Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Report mode changes nothing. To remove an installed update, open Settings > Windows Update > Update history > Uninstall updates, or run wusa /uninstall /kb:NUMBER as an administrator.

Version and change log